addyosmani/agent-skills 0.6.14

Agent Skills 0.6.14

on GitHub

Agent Skills 0.6.14 is mostly about code samples. More than twenty snippets across the skills either failed as written or taught the wrong thing, and they're fixed. It also closes two supply-chain and injection risks in the samples, stops Claude Code from starting /ship or /build on its own, and brings the root manifest in line with Agent Plugins 1.0.0.

Security fixes in the samples

• The Lighthouse CI example ran the unscoped lhci package (#721), which isn't Lighthouse CI. It now invokes @lhci/cli.
• The rollback workflow passed its input straight into run: (#691), a script injection in any repo that copied it. It goes through env now.
• The constraints skill scans the working tree for secrets, not only commits (#729), and the hardening reference returns 404 before an ownership check reads a missing task (#726).

Samples that now work as written

• Accessibility: labels are tied to their controls (#719), the loading region has a role so its label is exposed (#725), and the axe example runs the CLI that actually ships a binary (#720).
• Testing and debugging: the Playwright example finds list items by their text (#688), the Jest example isolates a file in a way Jest 30 still accepts (#712), and the coverage setup installs Vitest's coverage provider, without which CI fails (#713).
• Frontend: the task list passes its toggle and delete handlers down (#706), and the empty state declares its action prop (#692).
• API, CI and constraints: the idempotency guard returns the skill's own error shape (#710), setup-node is described as caching the package-manager cache, not node_modules (#711), a ratchet reads its direction from its own column (#708), and --fix reaches the linter through npm run (#690).
• Everything else: the deprecation adapter type-checks (#698), the attribution-build onINP import is aliased so it doesn't redeclare (#699), Lighthouse points at http://localhost (#727), the ADR example comment describes its own code (#707), the source-driven example quotes a sentence the React 19 post actually contains (#728), and the idea-refine helper runs from the installed skill (#724).

Skills and commands

• The lifecycle commands are user-invoked only (#714, @monraza). Claude Code now lists commands next to skills, so without this the model could start /ship, /build and the rest by itself. The skills underneath still route as before.
• code-simplification fires on pasted code (#696, @ayobamiseun), with the same one-clause change that worked for review and test-driven-development in #620, plus a case that keeps it quiet on "make it fast".

Hosts

• The root plugin.json is an Agent Plugins 1.0.0 manifest (#463). It validates against the published schema, and Antigravity and Copilot CLI load the same 25 skills as before. The Copilot guide explains what the new $schema line changes.
• The Antigravity guide tells you to write your own project AGENTS.md instead of copying this repo's (#747), Gemini MCP setup points at settings.json (#705), the Windsurf rules file gets real newlines between skills (#704), and the Cursor guide links the rules and skills pages (#723).

Evals and validators

• Routing understands clipped words (#668, @Yi-111-a). "docs", "auth", "config", "repo" and "deps" now match their long forms, and "specification" no longer stems into "specific". Rank-1 routing is 94 of 95.
• Behavioral runs that stop early are rejected, not graded (#743, @CybotTM). A run that hit max turns with a tool call left hanging used to score 4 of 4.
• The artifact-path check stops reading test-plan.md as plan.md (#702), and SDD-CACHE uses "reuse" throughout (#735, @DeadY2J).

Thanks

Thanks to everyone who contributed and reviewed this release: @rudycelekli (twenty-four of these fixes), @ayobamiseun, @Yi-111-a, @CybotTM, @monraza, @DeadY2J, @federicobartoli and @nucliweb.

Full Changelog: 0.6.13...0.6.14